Perform Tier 1 and Tier 2 triage of threat intelligence alerts, monitor threat feeds and intelligence platforms, investigate suspicious activity, enrich and validate indicators, escalate credible threats to incident response, track ongoing events, and document clear actionable summaries to support response.